Fortified’s Threat Services Team tracks the most pressing cyber threats targeting the healthcare sector each month. April’s activity surrounding PipeMagic ransomware, Oracle’s dual breach allegations, and the news regarding the DaVita ransomware attack illuminate a stark reality: the healthcare sector is under sustained siege from sophisticated threat actors intensifying their focus on healthcare’s legacy systems, cloud platforms, and clinical operations. 

In this monthly briefing, I will discuss these top incidents, assess their impact on the healthcare ecosystem, and share actionable recommendations for improving your organization’s cyber resilience.  

PipeMagic Ransomware: Exploiting Windows CLFS Vulnerability  

Overview:

The hacking group Storm-2460 is exploiting a vulnerability in the Windows Common Log File System (CLFS) driver (CVE-2025-29824) to escalate privileges and deploy ransomware. This zero-day exploit, now patched, allows attackers to gain system-level access, particularly affecting Windows 10 and certain versions of Windows 11.  

Healthcare Impact:

This vulnerability significantly elevates the risk of ransomware deployment within clinical networks—particularly in environments still running unpatched Windows 10 or 11 versions. If exploited, threat actors could move laterally across hospital domains, disrupt access to systems that support EHR workflows, impair medical devices connected via Windows endpoints, and increase the risk of PHI exfiltration for double extortion. Given healthcare’s dependence on real-time data and system uptime, such an exploit could trigger operational shutdowns, patient safety events, and HIPAA-reportable breaches—making it a critical threat vector for healthcare organizations.

Recommendations:  

  • Immediate Patch Deployment: Apply Microsoft’s patch for CVE-2025-29824 across all affected Windows 10 and Windows 11 systems, prioritizing clinical and administrative endpoints.
  • Privilege Management: Audit and restrict the use of SeDebugPrivilege and other high-risk permissions to essential personnel and service accounts only.
  • Endpoint Monitoring: Use your SIEM or EDR tools to detect abnormal activity involving CLFS driver processes, privilege escalation attempts, or ransomware indicators.
  • Threat Hunting: Launch proactive threat-hunting activities focused on privilege escalation patterns and lateral movement behaviors across clinical network segments.
  • Asset Visibility: Ensure all Windows-based endpoints, including those supporting diagnostic imaging, lab systems, or nurse stations, are included in patch and detection coverage.

Questions to Ask Your Team:

  • Has your team identified the affected host and determined the risk and impact?
  • Has your team identified the patches or alternative corrective actions needed to mitigate risk and impact?
  • Has your team defined a patch deployment strategy and approved the change management window?
  • Does this patch or alternative action require a system reboot or system downtime based on a remediation strategy?

Oracle’s Dual Data Breaches: Cloud and Health Divisions Targeted  

Overview:

Oracle is reportedly dealing with two separate data breaches: one involving Oracle Cloud’s federated Single Sign-On (SSO) and LDAP systems, and another affecting Oracle Health (formerly Cerner), where threat actors stole patient data from legacy servers. While Oracle denies the cloud breach, evidence suggests otherwise, and the company has remained silent on the health division incident.  

Healthcare Impact:

The breach tied to Oracle Health highlights the persistent risk of legacy healthcare infrastructure—especially systems that house large volumes of PHI but often lack modern security controls. If cybercriminals can exfiltrate data from these environments, it could result in significant privacy violations, regulatory exposure, and long-term reputational damage. Additionally, the lack of transparency and delayed public communication from Oracle underscores the need for healthcare entities to demand stronger breach notification and response alignment from their third-party vendors.

Recommendations:  

  • Credential Management: Reset all passwords associated with Oracle Cloud and Oracle Health (Cerner) accounts, especially for privileged and service accounts.
  • Multi-Factor Authentication (MFA): Enforce MFA across all user types, including administrative, clinical, and third-party vendor accounts.
  • Key and Certificate Rotation: Replace all potentially exposed API keys, certificates, and authentication tokens.
  • Vendor Risk Management: Reassess third-party risk scoring and require breach notification SLAs in all vendor contracts.
  • Incident Response: Conduct threat hunting and monitoring for indicators of compromise across systems integrated with Oracle platforms.

Questions to Ask Your Team:

  • Are you operating in either of the alleged affected environments, Oracle Cloud or Oracle Health?
  • Have you received a notification from Oracle or others indicating involvement?
  • Has your team identified user populations of potentially impacted users for a password reset?
  • Has your team confirmed MFA enablement and determined if API keys and certificates need to be updated?

DaVita Ransomware Attack: Operational Disruption with Ongoing Patient Care  

Overview:

DaVita, a major dialysis provider, experienced a ransomware attack that encrypted parts of its network, disrupting operations across its U.S. clinics. Despite the attack, DaVita has implemented contingency plans to continue patient care and is working with cybersecurity experts and law enforcement.  

Healthcare Impact:

The DaVita incident illustrates how ransomware can threaten care continuity, even when contingency plans are in place. For a dialysis provider, delays in treatment—even by hours—can pose life-threatening risks for patients. While DaVita maintained operations, the attack disrupted clinic workflows, stressed clinical and IT teams, and raised questions about the resilience of essential care services during a cyber event. The incident reinforces the urgent need for providers to integrate cybersecurity planning into their clinical operations strategy—not as an IT function, but as a patient safety imperative.

Recommendations:  

  • Business Continuity Planning: Validate and test downtime protocols for critical clinical workflows such as dialysis, medication delivery, and patient scheduling.
  • Employee Training: Deliver targeted cybersecurity awareness training focused on phishing, credential security, and ransomware indicators.
  • Network Segmentation: Segment networks to isolate clinical systems and limit lateral movement. Include OT/IoT systems like dialysis machines in your segmentation strategy.
  • Regular Backups: Maintain immutable, offsite backups of both administrative and clinical systems; validate recovery procedures quarterly.
  • Tabletop Exercises: Simulate ransomware scenarios that include care delivery disruptions and communication with regulators, patients, and media.

Questions to Ask Your Team:

  • When was the last time you tested your business continuity and resilience strategy?
  • When did you last perform a tabletop exercise or test your clinical downtime procedures?
  • Have you defined your maximum acceptable data loss if restoring from immutable backups becomes necessary?
  • What mitigation measures have you implemented to minimize cyber incident impact, and have you leveraged network segmentation to isolate critical business functions?

Securing Data, Systems, and Care Continuity in a Persistent Threat Environment 

These incidents are not isolated—they reflect systemic vulnerabilities across legacy infrastructure, third-party platforms, and operational workflows. 

Data security must now go beyond perimeter defense. It requires a zero-trust mindset rooted in least-privilege access, continuous identity verification, and robust encryption—both in transit and at rest. Data classification policies should identify mission-critical, and PHI datasets and those must be isolated and protected with layered controls such as tokenization, immutable backups, and endpoint detection and response (EDR).  

At the same time, incident response cannot be a static playbook. Healthcare providers must simulate real-world attacks through tabletop exercises, incorporate forensics readiness, and ensure that third-party partners—especially EHR vendors and managed service providers—are integrated into joint response protocols. Recovery objectives (RTO/RPO) should be clearly defined and tested quarterly, not annually. 

Protecting Care Delivery: What Healthcare Providers Must Do Now 

To maintain operational resilience while under cyber duress, healthcare delivery organizations should focus on four priority areas:

1. Establish a Cyber-Resilient Clinical Operations Plan

  • Identify mission-critical systems—such as EHR, imaging, scheduling, and pharmacy—that require high availability or rapid restoration.
  • Implement clinical failover protocols, including offline patient care kits and redundant communication channels.
  • Pre-stage critical workflow scripts (e.g., emergency dialysis processes, lab order routing) to reduce decision fatigue during system outages.

2. Segment and Secure the Clinical Network

  • Segment medical devices, administrative workstations, and clinical systems into discrete security zones.
  • Deploy network access controls (NAC) to enforce least-privilege connectivity and detect unauthorized behaviors.
  • Restrict internet access for systems that do not require external connectivity—especially legacy or specialty platforms.

3. Strengthen Identity and Access Controls

  • Enforce multi-factor authentication (MFA) for all privileged, clinical, and remote access accounts.
  • Implement just-in-time (JIT) access protocols for third-party vendors and internal support staff.
  • Conduct regular user access reviews, and promptly disable dormant or unused accounts.

4. Build and Practice a 360-degree Incident Response Ecosystem

  • Develop tailored incident response playbooks that include clinical workflow disruption scenarios and care coordination escalation paths.
  • Integrate external partners, such as MSSPs, EHR vendors, legal counsel, and law enforcement, into your cyber response framework.
  • Establish predefined communication protocols for engaging internal stakeholders, patients, regulators, and the media during a crisis.

These are not aspirational goals; they are minimum viable defenses in today’s threat landscape. Cybersecurity is now inseparable from patient safety and clinical reliability. As healthcare organizations evolve their digital ecosystems, security leaders must ensure their protective strategies evolve in parallel—resilient, proactive, and deeply embedded into the fabric of care operations.